# Json filter and removing json fields

**URL:** <https://discuss.elastic.co/t/json-filter-and-removing-json-fields/52556>\
**Category:** Logstash\
**Created:** [June 13, 2016, 2:43am UTC](https://discuss.elastic.co/t/json-filter-and-removing-json-fields/52556 "2016-06-13T02:43:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![quietrags](https://avatars.discourse-cdn.com/v4/letter/q/5f9b8f/32.png) [@quietrags](https://discuss.elastic.co/u/quietrags)\
**Post date:** [June 13, 2016, 2:43am UTC](https://discuss.elastic.co/t/json-filter-and-removing-json-fields/52556/1 "2016-06-13T02:43:12Z")

</div>

I am using the json filter in my logstash processing and i would like to remove some of the json fields that get parsed. I am unable to figure out what the format should be.

Here is my json { "cookies" : {"x" : 1, "more-cookies" : {"y" : 0, "z":0} } }  
I understand that there are two ways to remove this - 1. In the json filter itself and the other in the mutate filter. But neither of the two are working for me.

filter {  
grok {  
.....  
}

json {  
source =\> "json-message"  
remove\_fields =\> ["y"]  
}

}

I have tried the mutate with this as well like so

filter {  
grok {  
.....  
}

json {  
source =\> "json-message"  
remove\_fields =\> ["y"]  
}

mutate {  
remove\_fields =\> ["cookies.more-cookies.y"]  
}

But this does not work as well.

How does one remove a nested field when using the json filter in logstash. Any help is very appreciated.

Thanks

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 13, 2016, 8:43am UTC](https://discuss.elastic.co/t/json-filter-and-removing-json-fields/52556/2 "2016-06-13T08:43:42Z")

</div>

> [@quietrags](#):
>
> mutate { remove\_fields =\> ["cookies.more-cookies.y"] }

I think this should be` ["[cookies][more_cookies][y]"]`.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:53am UTC](https://discuss.elastic.co/t/json-filter-and-removing-json-fields/52556/3 "2017-07-06T04:53:23Z")

</div>